storm/w3m
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update ssl_min_version to accept "all" and reject "SSLv2"

Browse Source
This commit is contained in:
Tatsuya Kinoshita
2021-02-11 17:06:32 +09:00
parent 8df4e0355a
commit fb9f1c0356
3 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
doc-jp/README.SSL
View File

@@ -28,7 +28,7 @@ SSL サポートについて
5: TLSv1.1, 6: TLSv1.2, 7: TLSv1.3) 5: TLSv1.1, 6: TLSv1.2, 7: TLSv1.3)
(デフォルトは2, 3, t, 5). (デフォルトは2, 3, t, 5).
ssl_min_version ssl_min_version
最小のSSLバージョン, OpenSSL 1.1以上で有効(TLSv1.0, TLSv1.1, 最小のSSLバージョン, OpenSSL 1.1以上で有効(all, TLSv1.0, TLSv1.1,
TLSv1.2, TLSv1.3のいずれか) (デフォルトは<NULL>). TLSv1.2, TLSv1.3のいずれか) (デフォルトは<NULL>).
ssl_ciphers ssl_ciphers
TLSv1.2以下用のSSL暗号(例: DEFAULT:@SECLEVEL=2) (デフォルトは TLSv1.2以下用のSSL暗号(例: DEFAULT:@SECLEVEL=2) (デフォルトは

2
rc.c
View File

@@ -206,7 +206,7 @@ static int OptionEncode = FALSE;
#endif /* USE_SSL_VERIFY */ #endif /* USE_SSL_VERIFY */
#define CMT_SSL_FORBID_METHOD N_("List of forbidden SSL methods (2: SSLv2, 3: SSLv3, t: TLSv1.0, 5: TLSv1.1, 6: TLSv1.2, 7: TLSv1.3)") #define CMT_SSL_FORBID_METHOD N_("List of forbidden SSL methods (2: SSLv2, 3: SSLv3, t: TLSv1.0, 5: TLSv1.1, 6: TLSv1.2, 7: TLSv1.3)")
#ifdef SSL_CTX_set_min_proto_version #ifdef SSL_CTX_set_min_proto_version
#define CMT_SSL_MIN_VERSION N_("Minimum SSL version (TLSv1.0, TLSv1.1, TLSv1.2, or TLSv1.3)") #define CMT_SSL_MIN_VERSION N_("Minimum SSL version (all, TLSv1.0, TLSv1.1, TLSv1.2, or TLSv1.3)")
#endif #endif
#define CMT_SSL_CIPHER N_("SSL ciphers for TLSv1.2 and below (e.g. DEFAULT:@SECLEVEL=2)") #define CMT_SSL_CIPHER N_("SSL ciphers for TLSv1.2 and below (e.g. DEFAULT:@SECLEVEL=2)")
#endif /* USE_SSL */ #endif /* USE_SSL */

12
url.c
View File

@@ -297,6 +297,10 @@ init_PRNG()
static int static int
str_to_ssl_version(const char *name) str_to_ssl_version(const char *name)
{ {
if(!strcasecmp(name, "all"))
return 0;
if(!strcasecmp(name, "none"))
return 0;
#ifdef TLS1_3_VERSION #ifdef TLS1_3_VERSION
if (!strcasecmp(name, "TLSv1.3")) if (!strcasecmp(name, "TLSv1.3"))
return TLS1_3_VERSION; return TLS1_3_VERSION;
@@ -317,11 +321,7 @@ str_to_ssl_version(const char *name)
return SSL3_VERSION; return SSL3_VERSION;
if (!strcasecmp(name, "SSLv3")) if (!strcasecmp(name, "SSLv3"))
return SSL3_VERSION; return SSL3_VERSION;
if (!strcasecmp(name, "SSLv2.0")) return -1;
return SSL2_VERSION;
if (!strcasecmp(name, "SSLv2"))
return SSL2_VERSION;
return 0;
} }
#endif /* SSL_CTX_set_min_proto_version */ #endif /* SSL_CTX_set_min_proto_version */
@@ -372,7 +372,7 @@ openSSLHandle(int sock, char *hostname, char **p_cert)
if (ssl_min_version && *ssl_min_version != '\0') { if (ssl_min_version && *ssl_min_version != '\0') {
int sslver; int sslver;
sslver = str_to_ssl_version(ssl_min_version); sslver = str_to_ssl_version(ssl_min_version);
if (sslver <= 0 if (sslver < 0
|| !SSL_CTX_set_min_proto_version(ssl_ctx, sslver)) { || !SSL_CTX_set_min_proto_version(ssl_ctx, sslver)) {
free_ssl_ctx(); free_ssl_ctx();
goto eend; goto eend;